BDSG

BDSG stands for Bundesdatenschutzgesetz, the Federal Data Protection Act of Germany. It provides the national framework for the protection of personal data and operates alongside the European Union's General Data Protection Regulation (GDPR). The GDPR is directly applicable across the EU, while the BDSG adds German-specific rules and clarifications in areas where national law remains necessary or where the GDPR allows national legislation.

Scope and application: The BDSG primarily governs the processing of personal data by federal authorities and public bodies. In the private sector, the GDPR sets the main rules, but the BDSG contains supplementary provisions for particular contexts such as employment data, video surveillance, and research or archival purposes. It also addresses national rules on data protection officers, documentation, ex post oversight, and penalties in the German system.

Key provisions and enforcement: The act outlines the duties of data controllers and processors, data security requirements, and conditions for processing sensitive data. It preserves data subject rights established by the GDPR and provides national procedures for supervisory and enforcement actions, often in cooperation with the federal and state data protection authorities.

Supervision: The Federal Commissioner for Data Protection and Freedom of Information (BfDI) leads the federal supervisory framework under the BDSG, coordinating with Germany’s 16 state data protection authorities to monitor compliance and enforce data protection laws.

History and current status: The BDSG has its origins in early German data protection regulation and was significantly revised to align with the GDPR in 2018. It continues to operate as Germany’s complementary national data protection statute, adapted by subsequent amendments to reflect EU policy and national needs.